CISCO IOS in a Nutshell

Tunnels

Tunnels take packets from one network, encapsulate them within an IP protocol, and transfer them to another network. This sounds inefficient, and in a sense it is. Why would you want to take perfectly good packets, wrap them up in some other protocol, send them to another location, and unwrap them? For two reasons. First, many protocols can’t be routed. If you want to connect two sites using nonroutable protocols, the only way to do so is to wrap the nonroutable protocols within a routable protocol, such as IP. Second, it’s increasingly common to use the Internet to connect remote sites to a central office. But this connection has its perils, the most significant of which is security. Do you really want corporate data flowing over the public Internet? To minimize security problems, you can establish a tunnel between the offices and then encrypt all the traffic on the tunnel.

In this section, we’ll first look at how to establish a tunnel, then at how to encrypt the traffic traveling over the tunnel. We won’t discuss encapsulating nonroutable protocols within IP in any detail. Figure 12-3 shows two offices connected by an ISP. The ISP has assigned two IP addresses for our use: 192.168.1.1 and 192.168.10.2.1. The network numbers used by Offices 1 and 2 are 10.10.1.0/24 and 10.10.2.0/24, respectively.

Here’s the configuration for Office 1:

hostname Office1 ! ! Configure the interface tunnel interface tunnel1 ! Use an unnummbered IP address to stay in sync with serial0 and make ...